CVE-2026-10685 is a documentation-implementation contract violation in Zephyr's GATT subscription API that creates a memory safety vulnerability triggered by malformed ATT responses from peer devices.
The bug lives in the GATT subscription teardown path. The public API documentation states that when a notify callback is invoked with NULL data (notify(conn, params, NULL, 0)), the application owns the params struct and may free or reuse it. The implementation then violates this contract by dereferencing params->subscribe() after sending that signal — touching memory the documentation explicitly released back to the application.
The trigger condition matters practically: this code path executes when a GATT server responds to a CCC (Client Characteristic Configuration) write with an ATT Error Response. Well-behaved Bluetooth stacks don't generate these, but interoperability failures are endemic in the Bluetooth ecosystem — misbehaving peers are far more common than developers assume. Any Zephyr device operating as a GATT client in environments with uncontrolled radio peers (wearables, industrial sensors, medical devices) can trigger this.
The memory behavior at the moment of dereference determines exploitability. If the application followed documentation and freed the params struct, this is a use-after-free — exploitability depends on allocator state. If the application reused or zeroed the struct (a common informal pattern), the bug manifests as corrupted state propagation into the connection object's subscription bookkeeping. This corrupts shared state that subsequent subscribe/unsubscribe operations on the same connection depend on, expanding impact beyond the immediate crash.
To assess exposure: identify all code paths where your application calls bt_gatt_subscribe() and registers a notification callback. Determine whether that callback ever passes NULL data back to your application. If so, verify your handler does not access the params struct after receiving that signal. Check whether your device communicates with peer devices you don't control — if yes, you're in the trigger population regardless of the CVSS scoring.
The patch reorders operations to dereference params before invoking the notify callback, but the systemic lesson is that error-path code in Bluetooth stacks receives insufficient scrutiny, and API contracts documented but not enforced at runtime create silent failures that surface only when non-compliant peers are encountered.